欢迎来到天天文库
浏览记录
ID:39754932
大小:204.84 KB
页数:16页
时间:2019-07-10
《Challenges in the Automated Testing of》由会员上传分享,免费在线阅读,更多相关内容在学术论文-天天文库。
1、ChallengesintheAutomatedTestingofModernWebApplicationsNathanHamielGregoryFleischerSethLawJustinEnglerAbstractTheattacksurfaceofmodernapplicationsisamulti-facetedandfragmentedenvironment.Currentautomatedsecuritytoolshavebeenfoundlackinginmanyareaswhenlookingatthefullscopeofanapplicationassessment.
2、Mostsecurityprofessionalsfilltheseholesusingavarietyoftoolstocoverasmuchoftheattacksurfaceaspossible,includingcustomscripts,manualtesting,andsemi-automatedtesting.Thisapproachputsextremepressureonsecurityprofessionals,asthetestingeffortmaybedifficulttoduplicatebetweendifferentassessments.Thisalso
3、forcesthetestertorecreatethetestprocessforeachassessmenttoensurecompletecoveragewhenassessinganapplication’ssecurityposture.Addressingthesedeficienciesrequiresimprovedtoolsthatevolvepurelymanualtestingintosemi-automatedtestingaswellasprovidingsupportforthecontinuedneedofcustomscriptcreation.Overv
4、iewItcanbescarytothinkabouthowlittleofthemodernattacksurfacemanytoolscover.Thereisnoonebesttoolforthejob,andontopofthat,sometoolsdon’tdoagreatjobatanything.Ofteninthehandsofgeneralusersthecapabilitiesandlimitationsarenoteventhoughtofduringtesting.Point,click,done.Theattacksurfaceofmodernwebenviro
5、nmentsaswellastheirprotectionmechanismshavebecomemorecomplicatedandyetmanytoolshavenotadapted.Thereiscertainlynoshortageofvulnerabilitiesinmodernwebenvironments,butweshouldbelookingbeyondlowhangingfruitatthispoint.Inbetweenfullyautomatedscannersandmanualtestingliesasweetspotfortheidentificationof
6、vulnerabilities.Someofthejuiciestpiecesofinformationarenotfoundbyvulnerabilityscannersbutarefoundbyhumanscreatingcustomtests.Thisiswhysemi-automatedtestingspaceissoimportant.Allofthiscomplicatedblendingofprotectionmechanisms,services,andRIAtechnologiesmeansthatmovingintotheareaofsemi-automatedtes
7、tingcanbefraughtwithfailure.Wedetailhowthesefailurescanbeavoidedaswellasprovideatoolthatsolvessomeoftheseproblemsaswellasprovidesanalysisforyourowntoolsandscripts.ProblemsAutomatedTestingversusModernApplicationsAutomat
此文档下载收益归作者所有